Hi! I'm trying to get the avg time of transactions where the duration is longer than normal. I can successfully do what I want in a appendcols clause, but it feels like hard work for something simple. The appendcols is added at the end to show you what I wanted to do. index=ourindex APIRequestStart OR APIRequestStop | transaction uuid startswith="* - APIRequestStart" endswith="* - APIRequestStop" | timechart count(eval(duration>2)) AS "Number Slow Transactions", **avg(eval(duration>2)) AS "Avg Slow Transactions"**, count AS "Total Transactions", avg(duration) AS "Avg Transactions" span=1h | appendcols [search index=index_cesoa* APIRequestStart OR APIRequestStop | transaction uuid startswith="* - APIRequestStart" endswith="* - APIRequestStop" | where duration > 2 | timechart avg(duration) AS "Working Avg Slow Transactions" span=1h] ... View more